Threat database

CVE-2026-47699 is a path traversal vulnerability in Confidential Containers Guest Components versions 0.16.0 through 0.19.x. It allows a crafted OCI image layer to create a hardlink outside the intended directory during image unpacking, potentially enabling a workload owner to escape into the pod virtual machine and abuse its capabilities. The issue is fixed in version 0.20.0.

CVE-2025-61779 is a high-severity authorization bypass vulnerability in the Confidential Containers Trustee project versions prior to 0.15.0. The flaw exists because the attestation-policy endpoint does not verify if the requesting kbs-client is authenticated or authorized, allowing any client to modify attestation policies. This can lead to unauthorized changes in security policies governing confidential guest attestation and secret provisioning. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Version 0.15.0 of the Trustee project addresses this issue by enforcing proper authentication checks. European organizations using Confidential Containers Trustee in affected versions are at risk of unauthorized policy manipulation, potentially compromising confidentiality and integrity of sensitive workloads.